> ## Documentation Index
> Fetch the complete documentation index at: https://gecko.security/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Fix a finding and confirm it's gone

> The paths from an open finding to Fixed, and how to confirm a fix you shipped yourself.

There are two separate questions after Gecko reports a finding: how do you fix
it, and how does Gecko learn that it's fixed? This guide covers both.

## Choose how to fix it

Open the finding and go to the **Fix** tab. It shows Gecko's suggested patch as
a diff against the affected files.

> **Let Gecko open the PR**
>
> Click **Create PR** (**Create MR** on GitLab). Gecko opens a pull request
> with the patch applied. Merging it marks the finding **Fixed** right away.

> **Fix it yourself**
>
> Use the patch as a starting point, or write your own fix, and ship it
> through your normal review process. Gecko confirms it on a later scan.

If the finding came from a pull request scan, the button reads
**Commit & Push Fix to PR** and adds the fix as a commit on that pull request
instead of opening a new one.

To fix several findings in one change, select them in the **Findings** table
and use the **Fix** bulk action. Gecko opens one combined pull request. The
selected findings must come from the same repository and the same scan.

See [Auto-fix PRs](https://gecko.security/docs/remediation/auto-fix-prs.md) for branch names, draft PRs,
labels, and automatic PR creation.

## How a finding becomes Fixed

| You did this | Gecko marks it Fixed when | Activity shows |
| - | - | - |
| Merged a Gecko fix PR | The PR merges | "Marked fixed after the PR containing the fix was merged." |
| Pushed a fix to the PR where the finding was reported | The PR is scanned again and no longer reports it | "Marked fixed after a pull request scan no longer detected this finding." |
| Merged your own fix | A later deep scan of that branch runs with **Fix detection** on | **Gecko** changed the status from **Open** to **Fixed**, with an explanation and the fixing commit |
| Anything else | You set the status to **Fixed** yourself | Your name |

If you close a Gecko fix PR without merging it, the finding goes back to
**Open**.

## Confirm a fix you merged yourself

This is the path that causes the most confusion, so here it is step by step.

**1. Turn on fix detection once**

An admin enables **Settings** > **Scanning** > **Fix detection**. Without it,
a deep scan never closes a finding on its own. See
[Re-scans and fix detection](https://gecko.security/docs/concepts/rescans.md#fix-detection).

**2. Merge the fix into the branch Gecko scans**

Fix detection checks the code on the scanned branch. A fix that only exists
on a feature branch is not visible to a scan of `main`.

**3. Scan that branch**

Run a scan of the default branch from the repository page, or wait for its
[scheduled scan](https://gecko.security/docs/scanning/scheduled-scans.md). Don't scan the feature branch the
fix was written on: findings there belong to a different line of history.

**4. Check the finding's Activity tab**

If Gecko confirmed the fix, the finding is **Fixed** and **Activity** explains
why the path is no longer exploitable and names the commit. If it's still
**Open**, Gecko wasn't confident the issue is gone. Read the call chain again,
or mark it **Fixed** yourself.

> [!NOTE]
>
> Fix detection skips findings that have a linked ticket or a fix in progress,
> so it never overrides work someone owns. If you track a finding in Jira or
> Linear, close it there or set the status in Gecko.

## If it comes back

When a **Fixed** finding is detected again by any later scan, Gecko reopens it
with "Reopened after a scan detected this finding again." The history stays on
the finding, so you can see when it regressed.

## Suggested fix vs fix detection

These are two different features that are easy to mix up:

* **Suggested fix** is the patch Gecko proposes on the **Fix** tab. It does
  nothing until you turn it into a PR or apply it yourself.
* **Fix detection** is a setting that rechecks open findings during deep scans
  and closes the ones whose code is fixed. It works whether or not you used
  Gecko's patch.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.